.- - -----÷M÷E÷N÷U÷------------------------------------------------------------- --- ----  -------------.
!  WALL ! STATS ! GOODIES ! YARA ! FAQ ! RSS ! EMV                                                      !
`--------------  - ---  ---------- -------- -------- -------- -------- ----------------- -  ---- ---- --'

                                           ATM MALWARE NOTICE 
                    c5b43b02a62d424a4e8a63b23bef8b022c08a889a15a6ad7f5bf1fd4fe73291f
 
Date...........: 2016-08-02
Family.........: ATMSpitter
File name......: ATMSpitter v2_1
File size......: 52.50 KB
Type file......: EXE/Windows
Virscan........: VT - HA
Documentation..: https://usa.visa.com/dam/VCOM/global/partner-with-us/documents/visa-technical-analysis-atm-jackpottingmalware.pdf
Additional note: ATMSpitter v2 XFS, Date check (2017) at 0x40996B (fill with NOP's) and 0x409972 
(replace JE by JMP)

Entropy:


Binary Histogram:



=== SCREENSHOT === 



=== PEDUMP REPORT === 
=== MZ Header === signature: "MZ" bytes_in_last_block: 144 0x90 blocks_in_file: 3 3 num_relocs: 0 0 header_paragraphs: 4 4 min_extra_paragraphs: 0 0 max_extra_paragraphs: 65535 0xffff ss: 0 0 sp: 184 0xb8 checksum: 0 0 ip: 0 0 cs: 0 0 reloc_table_offset: 64 0x40 overlay_number: 0 0 reserved0: 0 0 oem_id: 0 0 oem_info: 0 0 reserved2: 0 0 reserved3: 0 0 reserved4: 0 0 reserved5: 0 0 reserved6: 0 0 lfanew: 128 0x80 === DOS STUB === 00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......| === PE Header === signature: "PE\x00\x00" # IMAGE_FILE_HEADER: Machine: 332 0x14c x86 NumberOfSections: 8 8 TimeDateStamp: "2016-11-19 16:56:05" PointerToSymbolTable: 0 0 NumberOfSymbols: 0 0 SizeOfOptionalHeader: 224 0xe0 Characteristics: 783 0x30f RELOCS_STRIPPED, EXECUTABLE_IMAGE LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED 32BIT_MACHINE, DEBUG_STRIPPED # IMAGE_OPTIONAL_HEADER32: Magic: 267 0x10b 32-bit executable LinkerVersion: 2.23 SizeOfCode: 37888 0x9400 SizeOfInitializedData: 52736 0xce00 SizeOfUninitializedData: 3072 0xc00 AddressOfEntryPoint: 5488 0x1570 BaseOfCode: 4096 0x1000 BaseOfData: 45056 0xb000 ImageBase: 4194304 0x400000 SectionAlignment: 4096 0x1000 FileAlignment: 512 0x200 OperatingSystemVersion: 4.0 ImageVersion: 1.0 SubsystemVersion: 4.0 Reserved1: 0 0 SizeOfImage: 81920 0x14000 SizeOfHeaders: 1024 0x400 CheckSum: 81974 0x14036 Subsystem: 3 3 WINDOWS_CUI DllCharacteristics: 0 0 SizeOfStackReserve: 2097152 0x200000 SizeOfStackCommit: 4096 0x1000 SizeOfHeapReserve: 1048576 0x100000 SizeOfHeapCommit: 4096 0x1000 LoaderFlags: 0 0 NumberOfRvaAndSizes: 16 0x10 === DATA DIRECTORY === EXPORT rva:0x 0 size:0x 0 IMPORT rva:0x 11000 size:0x 88c RESOURCE rva:0x 0 size:0x 0 EXCEPTION rva:0x 0 size:0x 0 SECURITY rva:0x 0 size:0x 0 BASERELOC rva:0x 0 size:0x 0 DEBUG rva:0x 0 size:0x 0 ARCHITECTURE rva:0x 0 size:0x 0 GLOBALPTR rva:0x 0 size:0x 0 TLS rva:0x 13000 size:0x 18 LOAD_CONFIG rva:0x 0 size:0x 0 Bound_IAT rva:0x 0 size:0x 0 IAT rva:0x 111cc size:0x 140 Delay_IAT rva:0x 0 size:0x 0 CLR_Header rva:0x 0 size:0x 0 rva:0x 0 size:0x 0 === SECTIONS === NAME RVA VSZ RAW_SZ RAW_PTR nREL REL_PTR nLINE LINE_PTR FLAGS .text 1000 93b4 9400 400 0 0 0 0 60500060 R-X CODE IDATA .data b000 28 200 9800 0 0 0 0 c0300040 RW- IDATA .rdata c000 1244 1400 9a00 0 0 0 0 40600040 R-- IDATA .eh_fram e000 152c 1600 ae00 0 0 0 0 40300040 R-- IDATA .bss 10000 a30 0 0 0 0 0 0 c0600080 RW- UDATA .idata 11000 88c a00 c400 0 0 0 0 c0300040 RW- IDATA .CRT 12000 18 200 ce00 0 0 0 0 c0300040 RW- IDATA .tls 13000 20 200 d000 0 0 0 0 c0300040 RW- IDATA === TLS === RAW_START RAW_END INDEX CALLBKS ZEROFILL FLAGS 413019 41301c 41002c 412004 0 0 [?] can't find file_offset of VA 0x1002c === IMPORTS === MODULE_NAME HINT ORD FUNCTION_NAME kernel32.dll 52 CloseHandle kernel32.dll 87 CreateFileA kernel32.dll cf DeleteCriticalSection kernel32.dll ec EnterCriticalSection kernel32.dll 117 ExitProcess kernel32.dll 184 GetCommandLineA kernel32.dll 1ec GetFileSize kernel32.dll 1fe GetLastError kernel32.dll 211 GetModuleHandleA kernel32.dll 241 GetProcAddress kernel32.dll 273 GetSystemTime kernel32.dll 2de InitializeCriticalSection kernel32.dll 2e8 InterlockedExchange kernel32.dll 2fb IsDBCSLeadByteEx kernel32.dll 32e LeaveCriticalSection kernel32.dll 35c MultiByteToWideChar kernel32.dll 3b3 ReadFile kernel32.dll 436 SetFilePointer kernel32.dll 474 SetUnhandledExceptionFilter kernel32.dll 480 Sleep kernel32.dll 495 TlsGetValue kernel32.dll 4bd VirtualProtect kernel32.dll 4bf VirtualQuery kernel32.dll 4df WideCharToMultiByte kernel32.dll 4f3 WriteFile kernel32.dll 51b lstrlenA msvcrt.dll 50 _strdup msvcrt.dll 52 _stricoll msvcrt.dll 3b __getmainargs msvcrt.dll 46 __mb_cur_max msvcrt.dll 52 __p__environ msvcrt.dll 54 __p__fmode msvcrt.dll 69 __set_app_type msvcrt.dll 9a _cexit msvcrt.dll c0 _errno msvcrt.dll d7 _findclose msvcrt.dll d8 _findfirst msvcrt.dll de _findnext msvcrt.dll fe _fullpath msvcrt.dll 128 _iob msvcrt.dll 1a1 _onexit msvcrt.dll 1d2 _setmode msvcrt.dll 27f abort msvcrt.dll 286 atexit msvcrt.dll 288 atoi msvcrt.dll 28b calloc msvcrt.dll 2a4 fputc msvcrt.dll 2a9 free msvcrt.dll 2b1 fwrite msvcrt.dll 2b5 getenv msvcrt.dll 2c4 isspace msvcrt.dll 2d7 localeconv msvcrt.dll 2dc malloc msvcrt.dll 2de mbstowcs msvcrt.dll 2e2 memcpy msvcrt.dll 2f2 realloc msvcrt.dll 2f8 setlocale msvcrt.dll 2fa signal msvcrt.dll 302 strchr msvcrt.dll 303 strcmp msvcrt.dll 304 strcoll msvcrt.dll 309 strlen msvcrt.dll 30c strncpy msvcrt.dll 31e tolower msvcrt.dll 324 vfprintf msvcrt.dll 331 wcslen msvcrt.dll 33c wcstombs user32.dll 280 wvsprintfA MSXFS.dll 22 WFSStartUp MSXFS.dll 1f WFSOpen MSXFS.dll 19 WFSExecute MSXFS.dll 15 WFSClose MSXFS.dll 14 WFSCleanUp MSXFS.dll 1b WFSGetInfo MSXFS.dll 1a WFSFreeResult
=== Strings ===
File pos Mem pos ID Text ======== ======= == ==== 00000000004D 00000040004D 0 !This program cannot be run in DOS mode. 000000000178 000000400178 0 .text 0000000001A0 0000004001A0 0 .data 0000000001C8 0000004001C8 0 .rdata 0000000001EF 0000004001EF 0 @.eh_fram, 000000000216 000000400216 0 0@.bss 000000000240 000000400240 0 .idata 000000000D42 000000401942 0 SUBKf 000000000D7D 00000040197D 0 VALUf 000000000DBA 0000004019BA 0 EMPTf 000000000DF1 0000004019F1 0 _LONf 000000000E2A 000000401A2A 0 ITEMf 000000000E61 000000401A61 0 O_LOf 000000000E95 000000401A95 0 READf 000000000EC5 000000401AC5 0 _ERRf 000000000EF9 000000401AF9 0 _ERRf 000000000F6A 000000401B6A 0 HANDf 000000000FA3 000000401BA3 0 BUFFf 0000000010AC 000000401CAC 0 VIDEf 000000001173 000000401D73 0 REQ_f 0000000011A7 000000401DA7 0 RESUf 000000001213 000000401E13 0 TIMEf 00000000124A 000000401E4A 0 ELEVf 000000001275 000000401E75 0 LOCKf 000000001303 000000401F03 0 THREf 000000001354 000000401F54 0 LOCKf 0000000013E3 000000401FE3 0 STERf 000000001417 000000402017 0 OGREf 00000000144B 00000040204B 0 EMORf 000000001482 000000402082 0 FOUNf 00000000151A 00000040211A 0 _HIGf 0000000015D3 0000004021D3 0 OMMAf 000000001615 000000402215 0 _SRVf 000000001673 000000402273 0 _ERRf 0000000016CE 0000004022CE 0 _ERRf 00000000179F 00000040239F 0 ERROf 00000000185A 00000040245A 0 CYMIf 000000001891 000000402491 0 NSABf 0000000018FE 0000004024FE 0 ITIOf 00000000196C 00000040256C 0 OTOPf 0000000019DA 0000004025DA 0 LOSEf 000000001A71 000000402671 0 ACTIf 000000001B2A 00000040272A 0 OITEf 000000001B9C 00000040279C 0 NKNOf 000000001BD3 0000004027D3 0 STAKf 000000001C98 000000402898 0 SITIf 000000001CDA 0000004028DA 0 CTARf 000000001D9A 00000040299A 0 TAKEf 000000001DCA 0000004029CA 0 SLEFf 00000000303E 000000403C3E 0 <\t?</t; 000000005609 000000406209 0 D$p9D$0 0000000062ED 000000406EED 0 )D$,) 0000000066A9 0000004072A9 0 L$\9L$ 0000000072AE 000000407EAE 0 9l$Xv, 00000000732C 000000407F2C 0 9|$Xv7 0000000089F3 0000004095F3 0 r/9D$ 0000000091B1 000000409DB1 0 INOPf 0000000091F7 000000409DF7 0 EMPTf 000000009235 000000409E35 0 MANIf 000000009247 000000409E47 0 NOREf File pos Mem pos ID Text ======== ======= == ==== 000000009297 000000409E97 0 COINf 0000000092AC 000000409EAC 0 COINf 000000009313 000000409F13 0 NOVAf 000000009A00 00000040C000 0 libgcc_s_dw2-1.dll 000000009A13 00000040C013 0 __register_frame_info 000000009A29 00000040C029 0 libgcj-13.dll 000000009A37 00000040C037 0 _Jv_RegisterClasses 000000009A4B 00000040C04B 0 __deregister_frame_info 000000009A64 00000040C064 0 disp.txt 000000009FB4 00000040C5B4 0 Usage: %s <Service Logical Name> <Operation> 000000009FE4 00000040C5E4 0 Operation: info/disp/sht/retr/calc 00000000A008 00000040C608 0 Usage for disp operation: %s <Service Logical Name> disp <Cassette Number> <Banknotes Count> <Sleep(seconds)> 00000000A07C 00000040C67C 0 Usage: %s <Service Logical Name> disp <Cassette Number> <Banknotes Count> 00000000A0C8 00000040C6C8 0 Error! Banknotes Count (per dispense) should be from 1 to 60 00000000A108 00000040C708 0 Error! Cassette Slot Number should be from 1 to 16 00000000A141 00000040C741 0 Can't open log file! 00000000A157 00000040C757 0 Total Cash Amount: %d 00000000A16E 00000040C76E 0 Total Dispenses Count: %d 00000000A18C 00000040C78C 0 WFSOpen failed with error: WFS_ERR_INTERNAL_ERROR :-) 00000000A1C4 00000040C7C4 0 WFSStartUp failed with error: %s 00000000A1E8 00000040C7E8 0 WFSOpen failed with error: %s 00000000A20C 00000040C80C 0 Getting cash units information... 00000000A230 00000040C830 0 WFSGetInfo (WFS_INF_CDM_CASH_UNIT_INFO) failed with error: %s 00000000A270 00000040C870 0 Slot Type Status Ccy Value Count 00000000A294 00000040C894 0 --------------------------------------------- 00000000A2C3 00000040C8C3 0 REJECT 00000000A2CA 00000040C8CA 0 COUPON 00000000A2D1 00000040C8D1 0 REPCON 00000000A2D8 00000040C8D8 0 RECYCL 00000000A2DF 00000040C8DF 0 %d %-7s %-5s %.3s %-5d %-4d 00000000A2FC 00000040C8FC 0 WFSFreeResult failed with error: %s 00000000A324 00000040C924 0 Error! Total count of slots is %d, selected slot # %d ! 00000000A360 00000040C960 0 Executing dispense operation # %d of %d for %d banknotes... 00000000A3A0 00000040C9A0 0 WFSExecute (WFS_CMD_CDM_DISPENSE) failed with error: %s 00000000A3D9 00000040C9D9 0 %d:%.3s 00000000A3E5 00000040C9E5 0 Total Dispensed Now: %d %.3s 00000000A408 00000040CA08 0 WFSExecute (WFS_CMD_CDM_OPEN_SHUTTER) failed with error: %s 00000000A448 00000040CA48 0 Shutter successfully opened. Waiting %d seconds... 00000000A47C 00000040CA7C 0 WFSExecute failed with error: %s 00000000A49E 00000040CA9E 0 Shutter successfully closed. 00000000A4C4 00000040CAC4 0 WFSExecute (WFS_CMD_CDM_RETRACT) failed with error: %s 00000000A4FC 00000040CAFC 0 Success. 00000000A508 00000040CB08 0 WFSClose failed with error: %s 00000000A528 00000040CB28 0 WFSCleanUp failed with error: %s 00000000A54A 00000040CB4A 0 Finished. 00000000A5B4 00000040CBB4 0 Mingw runtime failure: 00000000A5CC 00000040CBCC 0 VirtualQuery failed for %d bytes at address %p 00000000A600 00000040CC00 0 Unknown pseudo relocation protocol version %d. 00000000A634 00000040CC34 0 Unknown pseudo relocation bit size %d. 00000000A662 00000040CC62 0 glob-1.0-mingw32 00000000A692 00000040CC92 0 (null) 00000000A699 00000040CC99 0 PRINTF_EXPONENT_DIGITS 00000000A820 00000040CE20 0 Infinity 00000000A847 00000040CE47 0 ?aCoc 00000000A867 00000040CE67 0 <2ZGU 00000000AA00 00000040D000 0 GCC: (GNU) 4.8.1 00000000AA14 00000040D014 0 GCC: (GNU) 4.8.1 00000000AA28 00000040D028 0 GCC: (GNU) 4.8.1 00000000AA3C 00000040D03C 0 GCC: (GNU) 4.8.1 00000000AA50 00000040D050 0 GCC: (GNU) 4.8.1 File pos Mem pos ID Text ======== ======= == ==== 00000000AA64 00000040D064 0 GCC: (GNU) 4.8.1 00000000AA78 00000040D078 0 GCC: (GNU) 4.8.1 00000000AA8C 00000040D08C 0 GCC: (GNU) 4.8.1 00000000AAA0 00000040D0A0 0 GCC: (GNU) 4.8.1 00000000AAB4 00000040D0B4 0 GCC: (GNU) 4.8.1 00000000AAC8 00000040D0C8 0 GCC: (GNU) 4.8.1 00000000AADC 00000040D0DC 0 GCC: (GNU) 4.8.1 00000000AAF0 00000040D0F0 0 GCC: (GNU) 4.8.1 00000000AB04 00000040D104 0 GCC: (GNU) 4.8.1 00000000AB18 00000040D118 0 GCC: (GNU) 4.8.1 00000000AB2C 00000040D12C 0 GCC: (GNU) 4.8.1 00000000AB40 00000040D140 0 GCC: (GNU) 4.8.1 00000000AB54 00000040D154 0 GCC: (GNU) 4.8.1 00000000AB68 00000040D168 0 GCC: (GNU) 4.8.1 00000000AB7C 00000040D17C 0 GCC: (GNU) 4.8.1 00000000AB90 00000040D190 0 GCC: (GNU) 4.8.1 00000000ABA4 00000040D1A4 0 GCC: (GNU) 4.8.1 00000000ABB8 00000040D1B8 0 GCC: (GNU) 4.8.1 00000000ABCC 00000040D1CC 0 GCC: (GNU) 4.8.1 00000000ABE0 00000040D1E0 0 GCC: (GNU) 4.8.1 00000000ABF4 00000040D1F4 0 GCC: (GNU) 4.8.1 00000000AC08 00000040D208 0 GCC: (GNU) 4.8.1 00000000AC1C 00000040D21C 0 GCC: (GNU) 4.8.1 00000000AC30 00000040D230 0 GCC: (GNU) 4.8.1 00000000C70E 00000041130E 0 CloseHandle 00000000C71C 00000041131C 0 CreateFileA 00000000C72A 00000041132A 0 DeleteCriticalSection 00000000C742 000000411342 0 EnterCriticalSection 00000000C75A 00000041135A 0 ExitProcess 00000000C768 000000411368 0 GetCommandLineA 00000000C77A 00000041137A 0 GetFileSize 00000000C788 000000411388 0 GetLastError 00000000C798 000000411398 0 GetModuleHandleA 00000000C7AC 0000004113AC 0 GetProcAddress 00000000C7BE 0000004113BE 0 GetSystemTime 00000000C7CE 0000004113CE 0 InitializeCriticalSection 00000000C7EA 0000004113EA 0 InterlockedExchange 00000000C800 000000411400 0 IsDBCSLeadByteEx 00000000C814 000000411414 0 LeaveCriticalSection 00000000C82C 00000041142C 0 MultiByteToWideChar 00000000C842 000000411442 0 ReadFile 00000000C84E 00000041144E 0 SetFilePointer 00000000C860 000000411460 0 SetUnhandledExceptionFilter 00000000C87E 00000041147E 0 Sleep 00000000C886 000000411486 0 TlsGetValue 00000000C894 000000411494 0 VirtualProtect 00000000C8A6 0000004114A6 0 VirtualQuery 00000000C8B6 0000004114B6 0 WideCharToMultiByte 00000000C8CC 0000004114CC 0 WriteFile 00000000C8D8 0000004114D8 0 lstrlenA 00000000C8E4 0000004114E4 0 _strdup 00000000C8EE 0000004114EE 0 _stricoll 00000000C8FA 0000004114FA 0 __getmainargs 00000000C90A 00000041150A 0 __mb_cur_max 00000000C91A 00000041151A 0 __p__environ 00000000C92A 00000041152A 0 __p__fmode 00000000C938 000000411538 0 __set_app_type 00000000C94A 00000041154A 0 _cexit 00000000C954 000000411554 0 _errno 00000000C95E 00000041155E 0 _findclose File pos Mem pos ID Text ======== ======= == ==== 00000000C96C 00000041156C 0 _findfirst 00000000C97A 00000041157A 0 _findnext 00000000C986 000000411586 0 _fullpath 00000000C99A 00000041159A 0 _onexit 00000000C9A4 0000004115A4 0 _setmode 00000000C9B0 0000004115B0 0 abort 00000000C9B8 0000004115B8 0 atexit 00000000C9CA 0000004115CA 0 calloc 00000000C9D4 0000004115D4 0 fputc 00000000C9E4 0000004115E4 0 fwrite 00000000C9EE 0000004115EE 0 getenv 00000000C9F8 0000004115F8 0 isspace 00000000CA02 000000411602 0 localeconv 00000000CA10 000000411610 0 malloc 00000000CA1A 00000041161A 0 mbstowcs 00000000CA26 000000411626 0 memcpy 00000000CA30 000000411630 0 realloc 00000000CA3A 00000041163A 0 setlocale 00000000CA46 000000411646 0 signal 00000000CA50 000000411650 0 strchr 00000000CA5A 00000041165A 0 strcmp 00000000CA64 000000411664 0 strcoll 00000000CA6E 00000041166E 0 strlen 00000000CA78 000000411678 0 strncpy 00000000CA82 000000411682 0 tolower 00000000CA8C 00000041168C 0 vfprintf 00000000CA98 000000411698 0 wcslen 00000000CAA2 0000004116A2 0 wcstombs 00000000CAAE 0000004116AE 0 wvsprintfA 00000000CABA 0000004116BA 0 MSXFS.dll 00000000CAC6 0000004116C6 0 WFSStartUp 00000000CADA 0000004116DA 0 WFSOpen 00000000CAEA 0000004116EA 0 WFSExecute 00000000CAFE 0000004116FE 0 WFSClose 00000000CB0E 00000041170E 0 WFSCleanUp 00000000CB22 000000411722 0 WFSGetInfo 00000000CB36 000000411736 0 WFSFreeResult 00000000CBB0 0000004117B0 0 kernel32.dll 00000000CBC8 0000004117C8 0 msvcrt.dll 00000000CC70 000000411870 0 msvcrt.dll 00000000CC80 000000411880 0 user32.dll 00000000A683 00000040CC83 0 f(null) 00000000004D 00000040004D 0 !This program cannot be run in DOS mode. 000000000178 000000400178 0 .text 0000000001A0 0000004001A0 0 .data 0000000001C8 0000004001C8 0 .rdata 0000000001EF 0000004001EF 0 @.eh_fram, 000000000216 000000400216 0 0@.bss 000000000240 000000400240 0 .idata 000000000D42 000000401942 0 SUBKf 000000000D7D 00000040197D 0 VALUf 000000000DBA 0000004019BA 0 EMPTf 000000000DF1 0000004019F1 0 _LONf 000000000E2A 000000401A2A 0 ITEMf 000000000E61 000000401A61 0 O_LOf 000000000E95 000000401A95 0 READf 000000000EC5 000000401AC5 0 _ERRf 000000000EF9 000000401AF9 0 _ERRf 000000000F6A 000000401B6A 0 HANDf 000000000FA3 000000401BA3 0 BUFFf File pos Mem pos ID Text ======== ======= == ==== 0000000010AC 000000401CAC 0 VIDEf 000000001173 000000401D73 0 REQ_f 0000000011A7 000000401DA7 0 RESUf 000000001213 000000401E13 0 TIMEf 00000000124A 000000401E4A 0 ELEVf 000000001275 000000401E75 0 LOCKf 000000001303 000000401F03 0 THREf 000000001354 000000401F54 0 LOCKf 0000000013E3 000000401FE3 0 STERf 000000001417 000000402017 0 OGREf 00000000144B 00000040204B 0 EMORf 000000001482 000000402082 0 FOUNf 00000000151A 00000040211A 0 _HIGf 0000000015D3 0000004021D3 0 OMMAf 000000001615 000000402215 0 _SRVf 000000001673 000000402273 0 _ERRf 0000000016CE 0000004022CE 0 _ERRf 00000000179F 00000040239F 0 ERROf 00000000185A 00000040245A 0 CYMIf 000000001891 000000402491 0 NSABf 0000000018FE 0000004024FE 0 ITIOf 00000000196C 00000040256C 0 OTOPf 0000000019DA 0000004025DA 0 LOSEf 000000001A71 000000402671 0 ACTIf 000000001B2A 00000040272A 0 OITEf 000000001B9C 00000040279C 0 NKNOf 000000001BD3 0000004027D3 0 STAKf 000000001C98 000000402898 0 SITIf 000000001CDA 0000004028DA 0 CTARf 000000001D9A 00000040299A 0 TAKEf 000000001DCA 0000004029CA 0 SLEFf 00000000303E 000000403C3E 0 <\t?</t; 000000005609 000000406209 0 D$p9D$0 0000000062ED 000000406EED 0 )D$,) 0000000066A9 0000004072A9 0 L$\9L$ 0000000072AE 000000407EAE 0 9l$Xv, 00000000732C 000000407F2C 0 9|$Xv7 0000000089F3 0000004095F3 0 r/9D$ 0000000091B1 000000409DB1 0 INOPf 0000000091F7 000000409DF7 0 EMPTf 000000009235 000000409E35 0 MANIf 000000009247 000000409E47 0 NOREf 000000009297 000000409E97 0 COINf 0000000092AC 000000409EAC 0 COINf 000000009313 000000409F13 0 NOVAf 000000009A00 00000040C000 0 libgcc_s_dw2-1.dll 000000009A13 00000040C013 0 __register_frame_info 000000009A29 00000040C029 0 libgcj-13.dll 000000009A37 00000040C037 0 _Jv_RegisterClasses 000000009A4B 00000040C04B 0 __deregister_frame_info 000000009A64 00000040C064 0 disp.txt 000000009FB4 00000040C5B4 0 Usage: %s <Service Logical Name> <Operation> 000000009FE4 00000040C5E4 0 Operation: info/disp/sht/retr/calc 00000000A008 00000040C608 0 Usage for disp operation: %s <Service Logical Name> disp <Cassette Number> <Banknotes Count> <Sleep(seconds)> 00000000A07C 00000040C67C 0 Usage: %s <Service Logical Name> disp <Cassette Number> <Banknotes Count> 00000000A0C8 00000040C6C8 0 Error! Banknotes Count (per dispense) should be from 1 to 60 00000000A108 00000040C708 0 Error! Cassette Slot Number should be from 1 to 16 00000000A141 00000040C741 0 Can't open log file! 00000000A157 00000040C757 0 Total Cash Amount: %d 00000000A16E 00000040C76E 0 Total Dispenses Count: %d File pos Mem pos ID Text ======== ======= == ==== 00000000A18C 00000040C78C 0 WFSOpen failed with error: WFS_ERR_INTERNAL_ERROR :-) 00000000A1C4 00000040C7C4 0 WFSStartUp failed with error: %s 00000000A1E8 00000040C7E8 0 WFSOpen failed with error: %s 00000000A20C 00000040C80C 0 Getting cash units information... 00000000A230 00000040C830 0 WFSGetInfo (WFS_INF_CDM_CASH_UNIT_INFO) failed with error: %s 00000000A270 00000040C870 0 Slot Type Status Ccy Value Count 00000000A294 00000040C894 0 --------------------------------------------- 00000000A2C3 00000040C8C3 0 REJECT 00000000A2CA 00000040C8CA 0 COUPON 00000000A2D1 00000040C8D1 0 REPCON 00000000A2D8 00000040C8D8 0 RECYCL 00000000A2DF 00000040C8DF 0 %d %-7s %-5s %.3s %-5d %-4d 00000000A2FC 00000040C8FC 0 WFSFreeResult failed with error: %s 00000000A324 00000040C924 0 Error! Total count of slots is %d, selected slot # %d ! 00000000A360 00000040C960 0 Executing dispense operation # %d of %d for %d banknotes... 00000000A3A0 00000040C9A0 0 WFSExecute (WFS_CMD_CDM_DISPENSE) failed with error: %s 00000000A3D9 00000040C9D9 0 %d:%.3s 00000000A3E5 00000040C9E5 0 Total Dispensed Now: %d %.3s 00000000A408 00000040CA08 0 WFSExecute (WFS_CMD_CDM_OPEN_SHUTTER) failed with error: %s 00000000A448 00000040CA48 0 Shutter successfully opened. Waiting %d seconds... 00000000A47C 00000040CA7C 0 WFSExecute failed with error: %s 00000000A49E 00000040CA9E 0 Shutter successfully closed. 00000000A4C4 00000040CAC4 0 WFSExecute (WFS_CMD_CDM_RETRACT) failed with error: %s 00000000A4FC 00000040CAFC 0 Success. 00000000A508 00000040CB08 0 WFSClose failed with error: %s 00000000A528 00000040CB28 0 WFSCleanUp failed with error: %s 00000000A54A 00000040CB4A 0 Finished. 00000000A5B4 00000040CBB4 0 Mingw runtime failure: 00000000A5CC 00000040CBCC 0 VirtualQuery failed for %d bytes at address %p 00000000A600 00000040CC00 0 Unknown pseudo relocation protocol version %d. 00000000A634 00000040CC34 0 Unknown pseudo relocation bit size %d. 00000000A662 00000040CC62 0 glob-1.0-mingw32 00000000A692 00000040CC92 0 (null) 00000000A699 00000040CC99 0 PRINTF_EXPONENT_DIGITS 00000000A820 00000040CE20 0 Infinity 00000000A847 00000040CE47 0 ?aCoc 00000000A867 00000040CE67 0 <2ZGU 00000000AA00 00000040D000 0 GCC: (GNU) 4.8.1 00000000AA14 00000040D014 0 GCC: (GNU) 4.8.1 00000000AA28 00000040D028 0 GCC: (GNU) 4.8.1 00000000AA3C 00000040D03C 0 GCC: (GNU) 4.8.1 00000000AA50 00000040D050 0 GCC: (GNU) 4.8.1 00000000AA64 00000040D064 0 GCC: (GNU) 4.8.1 00000000AA78 00000040D078 0 GCC: (GNU) 4.8.1 00000000AA8C 00000040D08C 0 GCC: (GNU) 4.8.1 00000000AAA0 00000040D0A0 0 GCC: (GNU) 4.8.1 00000000AAB4 00000040D0B4 0 GCC: (GNU) 4.8.1 00000000AAC8 00000040D0C8 0 GCC: (GNU) 4.8.1 00000000AADC 00000040D0DC 0 GCC: (GNU) 4.8.1 00000000AAF0 00000040D0F0 0 GCC: (GNU) 4.8.1 00000000AB04 00000040D104 0 GCC: (GNU) 4.8.1 00000000AB18 00000040D118 0 GCC: (GNU) 4.8.1 00000000AB2C 00000040D12C 0 GCC: (GNU) 4.8.1 00000000AB40 00000040D140 0 GCC: (GNU) 4.8.1 00000000AB54 00000040D154 0 GCC: (GNU) 4.8.1 00000000AB68 00000040D168 0 GCC: (GNU) 4.8.1 00000000AB7C 00000040D17C 0 GCC: (GNU) 4.8.1 00000000AB90 00000040D190 0 GCC: (GNU) 4.8.1 00000000ABA4 00000040D1A4 0 GCC: (GNU) 4.8.1 00000000ABB8 00000040D1B8 0 GCC: (GNU) 4.8.1 File pos Mem pos ID Text ======== ======= == ==== 00000000ABCC 00000040D1CC 0 GCC: (GNU) 4.8.1 00000000ABE0 00000040D1E0 0 GCC: (GNU) 4.8.1 00000000ABF4 00000040D1F4 0 GCC: (GNU) 4.8.1 00000000AC08 00000040D208 0 GCC: (GNU) 4.8.1 00000000AC1C 00000040D21C 0 GCC: (GNU) 4.8.1 00000000AC30 00000040D230 0 GCC: (GNU) 4.8.1 00000000C70E 00000041130E 0 CloseHandle 00000000C71C 00000041131C 0 CreateFileA 00000000C72A 00000041132A 0 DeleteCriticalSection 00000000C742 000000411342 0 EnterCriticalSection 00000000C75A 00000041135A 0 ExitProcess 00000000C768 000000411368 0 GetCommandLineA 00000000C77A 00000041137A 0 GetFileSize 00000000C788 000000411388 0 GetLastError 00000000C798 000000411398 0 GetModuleHandleA 00000000C7AC 0000004113AC 0 GetProcAddress 00000000C7BE 0000004113BE 0 GetSystemTime 00000000C7CE 0000004113CE 0 InitializeCriticalSection 00000000C7EA 0000004113EA 0 InterlockedExchange 00000000C800 000000411400 0 IsDBCSLeadByteEx 00000000C814 000000411414 0 LeaveCriticalSection 00000000C82C 00000041142C 0 MultiByteToWideChar 00000000C842 000000411442 0 ReadFile 00000000C84E 00000041144E 0 SetFilePointer 00000000C860 000000411460 0 SetUnhandledExceptionFilter 00000000C87E 00000041147E 0 Sleep 00000000C886 000000411486 0 TlsGetValue 00000000C894 000000411494 0 VirtualProtect 00000000C8A6 0000004114A6 0 VirtualQuery 00000000C8B6 0000004114B6 0 WideCharToMultiByte 00000000C8CC 0000004114CC 0 WriteFile 00000000C8D8 0000004114D8 0 lstrlenA 00000000C8E4 0000004114E4 0 _strdup 00000000C8EE 0000004114EE 0 _stricoll 00000000C8FA 0000004114FA 0 __getmainargs 00000000C90A 00000041150A 0 __mb_cur_max 00000000C91A 00000041151A 0 __p__environ 00000000C92A 00000041152A 0 __p__fmode 00000000C938 000000411538 0 __set_app_type 00000000C94A 00000041154A 0 _cexit 00000000C954 000000411554 0 _errno 00000000C95E 00000041155E 0 _findclose 00000000C96C 00000041156C 0 _findfirst 00000000C97A 00000041157A 0 _findnext 00000000C986 000000411586 0 _fullpath 00000000C99A 00000041159A 0 _onexit 00000000C9A4 0000004115A4 0 _setmode 00000000C9B0 0000004115B0 0 abort 00000000C9B8 0000004115B8 0 atexit 00000000C9CA 0000004115CA 0 calloc 00000000C9D4 0000004115D4 0 fputc 00000000C9E4 0000004115E4 0 fwrite 00000000C9EE 0000004115EE 0 getenv 00000000C9F8 0000004115F8 0 isspace 00000000CA02 000000411602 0 localeconv 00000000CA10 000000411610 0 malloc 00000000CA1A 00000041161A 0 mbstowcs 00000000CA26 000000411626 0 memcpy 00000000CA30 000000411630 0 realloc 00000000CA3A 00000041163A 0 setlocale File pos Mem pos ID Text ======== ======= == ==== 00000000CA46 000000411646 0 signal 00000000CA50 000000411650 0 strchr 00000000CA5A 00000041165A 0 strcmp 00000000CA64 000000411664 0 strcoll 00000000CA6E 00000041166E 0 strlen 00000000CA78 000000411678 0 strncpy 00000000CA82 000000411682 0 tolower 00000000CA8C 00000041168C 0 vfprintf 00000000CA98 000000411698 0 wcslen 00000000CAA2 0000004116A2 0 wcstombs 00000000CAAE 0000004116AE 0 wvsprintfA 00000000CABA 0000004116BA 0 MSXFS.dll 00000000CAC6 0000004116C6 0 WFSStartUp 00000000CADA 0000004116DA 0 WFSOpen 00000000CAEA 0000004116EA 0 WFSExecute 00000000CAFE 0000004116FE 0 WFSClose 00000000CB0E 00000041170E 0 WFSCleanUp 00000000CB22 000000411722 0 WFSGetInfo 00000000CB36 000000411736 0 WFSFreeResult 00000000CBB0 0000004117B0 0 kernel32.dll 00000000CBC8 0000004117C8 0 msvcrt.dll 00000000CC70 000000411870 0 msvcrt.dll 00000000CC80 000000411880 0 user32.dll 00000000A683 00000040CC83 0 f(null)
=== DOWNLOAD === Mirror provided by vx-underground.org, thx!